`reward-engine`: Proof CID format is unchecked — add basic IPFS CID validation

[cybermax4200]

Labels: feature, validation

Problem:
submit_proof accepts any String as proof_cid with no format validation:

pub fn submit_proof(e: Env, oracle: Address, user: Address, task_id: u64, proof_cid: String) {

A malformed or empty CID can be stored on-chain, making it impossible for the off-chain oracle or dispute system to retrieve the actual proof. This could be exploited to store a submission that can never be verified or disputed legitimately.

Scope:

• Add a helper that checks: non-empty, starts with "Qm" (CIDv0) or "bafy" (CIDv1), and is within a reasonable length bound (46–59 chars for v0, up to 64 for v1)
• Panic with "engine: invalid proof CID" on failure
• Add unit tests for valid CIDs, empty string, and malformed values